Insecure Temporary File

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execu...

ai.catboost:catboost-spark_3.0_2.12 (>=0.25, <=1.2.8), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +12361 more potentially affected by CVE-2026-106451 via org.lz4:lz4-java (>=1.7.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.7.0, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =0.0.115 and more Source cves: CVE-2026-106451 Source advisory: SNYK:JAVA-ORGLZ4-20570515...

ai.catboost:catboost-spark_3.0_2.12 (>=0.25, <=1.2.8), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +12361 more potentially affected by CVE-2026-106451 via org.lz4:lz4-java (>=1.7.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.7.0, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =0.0.115 and more Source cves: CVE-2026-106451 Source advisory: OSV:GHSA-MCR4-QMVW-PX4G...

Uncontrolled Recursion

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the LZ4BlockInputStream process. An attacker can cause excessive memory allocation and...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive...

CVE-2025-12183

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input...

CVE-2025-12183: Out-of-bounds Read

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input...

PT-2025-54723

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. This is fixed in a forked release: at.yawk.lz4:lz4-java version 1.8.1. The original project has been archived:...